Vendor: Google

Product: Virtual Private Cloud

Rules	Models	MITRE TTPs	Event Types	Parsers
53	21	9	1	1

Use-Case	Event Types/Parsers	MITRE TTP	Content
Compromised Credentials	netflow-connection ↳gcpvpc-netflow-connection	T1046 - Network Service Scanning	1 Rules 1 Models
Data Exfiltration	netflow-connection ↳gcpvpc-netflow-connection	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071.002 - Application Layer Protocol: File Transfer Protocols	1 Rules
Evasion	netflow-connection ↳gcpvpc-netflow-connection	T1090.003 - Proxy: Multi-hop Proxy	2 Rules
Lateral Movement	netflow-connection ↳gcpvpc-netflow-connection	T1021 - Remote Services T1021.001 - Remote Services: Remote Desktop Protocol T1043 - Commonly Used Port T1046 - Network Service Scanning T1071 - Application Layer Protocol T1090.002 - Proxy: External Proxy T1571 - Non-Standard Port	49 Rules 21 Models
Malware	netflow-connection ↳gcpvpc-netflow-connection	T1071 - Application Layer Protocol	1 Rules

ATT&CK Matrix for Enterprise

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
						Network Service Scanning	Remote Services Remote Services: Remote Desktop Protocol		Non-Standard Port Commonly Used Port Application Layer Protocol: File Transfer Protocols Proxy: Multi-hop Proxy Proxy: External Proxy Application Layer Protocol Proxy	Exfiltration Over Alternative Protocol Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol